awesome-threat-detection/README.md

Awesome Threat Detection and Hunting

A curated list of awesome threat detection and hunting resources

Contents

• Threat Detection and Hunting
  • Tools
  • Frameworks
  • Resources
  • Videos
  • Trainings
  • Twitter
• Contribute
• License

Tools

• HELK - A Hunting ELK (Elasticsearch, Logstash, Kibana) with advanced analytic capabilities.
• osquery - An operating system instrumentation framework for Windows, OS X (macOS), Linux, and FreeBSD. It exposes an operating system as a high-performance relational database.
• osquery-configuration - A repository for using osquery for incident detection and response.
• DetectionLab - Vagrant & Packer scripts to build a lab environment complete with security tooling and logging best practices.
• Sysmon-DFIR - Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.
• sysmon-config - Sysmon configuration file template with default high-quality event tracing
• Atomic Red Team - Small and highly portable detection tests mapped to the Mitre ATT&CK Framework
• Revoke-Obfuscation - PowerShell Obfuscation Detection Framework

Frameworks

• MITRE ATT&CK - A curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary’s lifecycle and the platforms they are known to target.
• MITRE CAR - The Cyber Analytics Repository (CAR) is a knowledge base of analytics developed by MITRE based on the Adversary Tactics, Techniques, and Common Knowledge (ATT&CK™) adversary model.
• Alerting and Detection Strategies Framework - A framework for developing alerting and detection strategies.
• A Simple Hunting Maturity Model
• The Pyramic of Pain
• A Framework for Cyber Threat Hunting
• The PARIS Model
• Cyber Kill Chain
• NIST Cybersecurity Framework

Resources

• Huntpedia - Your Threat Hunting Knowledge Compendium
• Hunt Evil - Your Practical Guide to Threat Hunting
• ThreatHunter-Playbook - A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.
• The ThreatHunting Project - A great collection of hunts and threat hunting resources.
• CyberThreatHunting - A collection of resources for threat hunters.
• Common Threat Hunting Techniques & Datasets
• Generating Hypotheses for Successful Threat Hunting
• Expert Investigation Guide - Threat Hunting
• David Bianco's Blog
• sqrrl Hunting Blog
• DFIR and Threat Hunting Blog
• CyberWardog's Blog
• Active Directory Threat Hunting
• Windows Commands Abused by Attackers
• osquery Across the Enterprise
• Tracking a stolen code-signing certificate with osquery
• Monitoring macOS hosts with osquery
• Alerting and Detection Strategy Framework
• A Framework for Cyber Threat Hunting (Part1, Part2, Part3)
• Deception-as-Detection - Deception based detection techniques mapped to the MITRE’s ATT&CK framework.

Videos

• SANS Threat Hunting and IR Summit 2017
• SANS Threat Hunting and IR Summit 2016
• BotConf 2016 - Advanced Incident Detection and Threat Hunting using Sysmon and Splunk
• BSidesCharm 2017 - Detecting the Elusive: Active Directory Threat Hunting
• BSidesAugusta 2017 - Machine Learning Fueled Cyber Threat Hunting
• Toppling the Stack: Outlier Detection for Threat Hunters
• BSidesPhilly 2017 - Threat Hunting: Defining the Process While Circumventing Corporate Obstacles
• Black Hat 2017 - Revoke-Obfuscation: PowerShell Obfuscation Detection (And Evasion) Using Science
• DefCon 25 - MS Just Gave the Blue Team Tactical Nukes
• BSides London 2017 - Hunt or be Hunted
• SecurityOnion 2017 - Pivoting Effectively to Catch More Bad Guys
• SkyDogCon 2016 - Hunting: Defense Against The Dark Arts
• BSidesAugusta 2017 - Don't Google 'PowerShell Hunting'
• BSidesAugusta 2017 - Hunting Adversaries w Investigation Playbooks & OpenCNA
• Visual Hunting with Linked Data
• RVAs3c - Pyramid of Pain: Intel-Driven Detection/Response to Increase Adversary's Cost

Trainings

• Threat Hunting Academy
• SANS FOR508 - Advanced Digital Forensics, Incident Response, and Threat Hunting.
• eLearnSecurity THP - Threat Hunting Professional

Twitter

• "Awesome Detection" Twitter List - Security guys who tweet about threat detection, hunting, DFIR, and red teaming
• "awesome-detection" Collection - A collection of tweets about threat detection, hunting, DFIR, and read teaming techniques that can help you create detection logics.

Contribute

Contributions welcome! Read the contribution guidelines first.

License

To the extent possible under law, Adel "0x4D31" Karimi has waived all copyright and related or neighboring rights to this work.